JWT Auditor
Audits JSON Web Tokens using a suite of advanced security tools via an MCP server.
About
JWTAuditorMCP is a powerful MCP server designed to provide a comprehensive suite of tools for auditing JSON Web Tokens. Inspired by JWTAuditor, it offers robust capabilities to decode JWT components, identify various security vulnerabilities (such as weak algorithms or sensitive data exposure), and even brute-force secrets. Additionally, it enables users to generate and modify JWTs, supporting both HS* and RS* algorithms. All operations are performed locally, ensuring sensitive data remains private, making it an invaluable resource for security researchers and developers working with JWTs.
Key Features
- Brute-force HS256/HS384/HS512 JWT secrets using a wordlist
- Generate and edit JWTs supporting HS* and RS* algorithms
- Decode JWT header, payload, and signature
- Analyze JWTs for vulnerabilities (e.g., alg=none, weak algorithms, missing claims)
- 0 GitHub stars
Use Cases
- Analyzing potential security vulnerabilities in JWTs during penetration testing
- Brute-forcing JWT secrets to assess the strength of cryptographic keys
- Creating and manipulating JWTs for development, testing, or security research purposes
Sponsored